QUIC: only negotiate Token Binding when PrivacyMode is disabled

net/quic/core/crypto/quic_crypto_client_config.cc

Index: net/quic/core/crypto/quic_crypto_client_config.cc
diff --git a/net/quic/core/crypto/quic_crypto_client_config.cc b/net/quic/core/crypto/quic_crypto_client_config.cc
index e1fd5f4c26bdb72991f07039ff22648fd7efde6d..f976fb6c83384330f5b31af93d3b85693ae99e77 100644
--- a/net/quic/core/crypto/quic_crypto_client_config.cc
+++ b/net/quic/core/crypto/quic_crypto_client_config.cc
@@ -550,7 +550,8 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello(
   out->SetVector(kAEAD, QuicTagVector{out_params->aead});
   out->SetVector(kKEXS, QuicTagVector{out_params->key_exchange});
 
-  if (!tb_key_params.empty()) {
+  if (!tb_key_params.empty() &&
+      server_id.privacy_mode() == PRIVACY_MODE_DISABLED) {
     const QuicTag* their_tbkps;
     size_t num_their_tbkps;
     switch (scfg->GetTaglist(kTBKP, &their_tbkps, &num_their_tbkps)) {